WolfSSL
/
meta-wolfssl
mirror of https://github.com/wolfSSL/meta-wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity
meta-wolfssl/recipes-core
History
Zackery 9eb5563329
Refactor finalization (#149) 
* Refactor meta-wolfssl: modularize feature enablement and centralize helpers in bbclass

Refactored layer.conf to unconditionally include all recipes, moved feature-specific configuration into modular .inc files, created wolfssl-helper.bbclass with reusable do_wolfssl_autogen and do_wolfssl_check_package tasks, updated all recipes to use the new pattern, and standardized commercial license variables to be recipe-specific.

Use a virtual wolfssl to make library switching easier for fips vs non fips or other wolfSSL packages

Set wolfssl libraries as the deafualt weak Preferred_Provider option for packages

* Merged refactor and new test changes

* Combine refactor changes and add replace default and fips modes

* Add working and tested fips, replace default, non-fips, non-replace-default work

* Add FIPS replace default to layers and test all options

* Refactor bbappends to be more yocto like

* Add overide to openssl configure

* Address comment concerns

* Only do neccesary simlinks

* Only do neccesary simlinks

* Convert wolfprovider test bbappend to inc file

* Add Image minimals for all wolfprovider modes

* Fully tested images

* Get conf files from source

* Fix FIPS package issues

* Fixes 7z extraction issues, mostly around using password when the
  password has already been stripped out
* Fixes autoreconf and configure issues with the FIPS package
* Fixes wolfcrypttest and wolfcryptbenchmark not being isntalled with
  FIPS when they are selected

* Fix unstable meta data for fips package

* Fix the execution command for QEMU

The execution of QEMU to get the hash would fail when cross-compiling to
a different CPU target. This fixes it.

* gnutls-wolfssl layers

Added 3 layers
- gnutls: gnutls fork patched to use wolfssl as cryptographic
  provider
- wolfssl: wolfssl configured to work against gnutls
- wolfssl-gnutls-wrapper: shim layer that gets called by gnutls
  applications when linked against gnutls-wolfssl
- gnutls-wolfssl-tests: tests from the wolfssl-gnutls-wrapper folder
  installed under /usr/lib/wolfssl-gnutls-wrapper/

Everything gets installed under /usr ovverriding the system installed
recipes, the wrapper is symlinked in /opt.
Fips currently not supported.

* fips support

* Removed hmac generation and installation since this step is already
happening on the base recipe

* gnutls layers (from https://github.com/wolfSSL/meta-wolfssl/pull/111/)
rebased against the new staging branch (refactor-meta-wolfssl)

* - added gnutls-image-minimal;
- update layer.conf to conditionally include gnutls-image-minimal if
  included in the WOLFSSL_DEMOS;
- minor update to inc/gnutls/gnutls-enable-wolfssl.inc to by pass the
  fuzzing binaries from the base recipes;

* added do_configure[network] = "1" to the inc file (fixes networking issues on
some builds)

* Add support for GCP and tarballs

The commercial package can now be retrieved from GCP and can be a
tarball without password protection.

* fix stamp.h in append rather than main .bb

* Update wolfprovider include files with local changes

* Add messages for debug files

* Follow Debian convention for provider config in openssl.cnf

- Install provider*.conf files to /etc/ssl/openssl.cnf.d/ instead of /opt
- Remove OPENSSL_CONF environment variable approach
- Add .include directive to openssl.cnf automatically in explicit load mode
- This allows OpenSSL to automatically load the provider configuration
- Update script output to reflect the new approach

* Append conf fil

* Don't use fixed version for FIPS

User can use any FIPS wolfSSL package

* Fix naming for new fips rename

* Add final wolfprovider refactor changes

* Benchmark and GPG Error Patch to resolve build issues and disable benchmarking due to length of time it takes to run AES GCM in current port

* Fixes for when GNUPG is needed

* Update wolfProvider images to match other demo images,
add to bbclass to ensure configurations are not added
to reciepes automatically.

* Fips Image for reference

* Fix openssl target detection

This was not working properly on an ARM64 build.

* Add symlink in ossl-modules, install provider.conf from main module

* Remove debug for wolfprovider

* Add fix for loading conf in wolfproviderenv

* linuxkm: add non-FIPS kernel module recipe and initramfs integration class

This introduces support for building the wolfSSL Linux kernel module (linuxkm)
in non-FIPS configurations and adds a generic bbclass for including the module
in any initramfs image.

Key additions:
 - New recipe: wolfssl-linuxkm.bb (non-FIPS)
   * Builds linuxkm against the target kernel
   * Installs libwolfssl.ko into /lib/modules/.../extra
   * Adds auto-load entry under /etc/modules-load.d/
   * Tracks upstream wolfSSL master at commit 3062d1524

 - New class: wolfssl-initramfs.bbclass
   * Allows any initramfs image to include the linuxkm module
   * Intended to be inherited from BSP/distro override layers

This prepares the layer for future FIPS/non-FIPS split support and provides
a clean mechanism for systems that need early-boot availability of the
wolfSSL kernel module.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

* Add openssl ptest patch

* Fix openssl patch

* linuxkm: update to latest commit to include randomness changes for Tegra kernel

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

* Add wolfssl-kernel-random.bbclass for kernel randomness patches

Bbclass to apply wolfSSL DRBG callback hooks to Linux kernel.
Fetches patches from wolfSSL GitHub, works with any kernel flavor.

Usage in kernel bbappend:
  inherit wolfssl-kernel-random
  WOLFSSL_KERNEL_RANDOM_PATCH = "5.17-ubuntu-jammy-tegra"

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

* Add curl ptest patch

* Make RD and FIPS detection more robust

* Refactor to handle all cases

* Wrong file location for curl .inc

* - Updated gnutls to point to the 3.8.11 branch to get the 3.8.11 version
  of gnutls-wolfssl (https://github.com/wolfSSL/gnutls/tree/gnutls-wolfssl-3.8.11);
- added nettle 3.10 recipe, gnutls depends on nettle to be >= 3.10;
- removed conditional bbappends in favor of the demo image and
  recipes-core + inc configuration setup;

* Add fix for wolfProvider curl FIPS

* Add openssh ptest patch for wolfprovider

* Fix location of openSSH patch to point to upstream osp

* linuxkm-fips: add Yocto recipe

Add commercial FIPS LinuxKM recipe.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Signed-off-by: Zackery Backman <zackery@wolfssl.com>

* Wolfprovider patch fix and other cleanup

* Add librelp ptest patch for FIPS

* Add support for wolfProvider RD unit test

* Add replace default method for fips image

* Update rev for wolfProvider

* Update wolfProvider ref

* Update ref version for pr 347

* fixing compatability and file layout for .incs porting

* fix pathing for gcrypt patch file

* FIPS-off gnutls recipes + minimal fips-off image.

* Update ref version for cmd test specific commit to pr 347

* fix buggy paths in meta-wolfssl

* Fix issue with missing config script and also add gcs to linuxkm recipe

* Move commercial bundle evaluation outside of recipes and into bbclass

* Cleanup to readmes

* remove the need for the librelp patch

* Update emails to point at support email

* add Gnutls images to the main readme

* Fix typo in example for wolfprovider meta-data and update licensing to point to 2024/correct md5sum

---------

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Signed-off-by: Zackery Backman <zackery@wolfssl.com>
Co-authored-by: Aidan Garske <aidan@wolfssl.com>
Co-authored-by: Andrew Hutchings <andrew@linuxjedi.co.uk>
Co-authored-by: Reda Chouk <reda@wolfssl.com>
Co-authored-by: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Co-authored-by: Sameeh Jubran <sameeh@wolfssl.com>
Co-authored-by: Andrew Hutchings <andrew@wolfssl.com>
 		2026-02-02 15:43:35 -07:00
..
images Refactor finalization (#149) 2026-02-02 15:43:35 -07:00
README.md Refactor finalization (#149) 2026-02-02 15:43:35 -07:00

README.md

wolfSSL Demo Images

This directory contains demonstration images for testing various wolfSSL sub-packages. Each image is a minimal Yocto image based on core-image-minimal with specific wolfSSL components installed and configured.

Enabling Demo Images

To enable a demo image, add the following to your conf/local.conf:

WOLFSSL_DEMOS = "wolfssl-image-minimal <image-name>"

Important: All demo images (except wolfssl-image-minimal itself) require wolfssl-image-minimal to be included in WOLFSSL_DEMOS because they inherit from it.

You can then build the image with:

bitbake <image-name>

Available Demo Images

1. wolfssl-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal"

Provides:

  • wolfSSL library (with reproducible build configuration)
  • wolfcrypttest - wolfSSL crypto test suite
  • wolfcryptbenchmark - wolfSSL crypto benchmark utility

Description: Base minimal image with wolfSSL and its core crypto testing tools. This serves as the foundation for all other demo images.

2. wolfclu-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfclu-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfCLU - Command-line utility for wolfSSL crypto operations

Description: Demonstrates wolfCLU command-line tools for performing cryptographic operations.

3. wolftpm-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolftpm-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfTPM library
  • wolftpm-wrap-test - wolfTPM wrapper test application
  • TPM 2.0 tools (tpm2-tools, tpm2-tss, libtss2)
  • bash shell

Requirements: Add to your conf/local.conf:

DISTRO_FEATURES += "security tpm tpm2"
MACHINE_FEATURES += "tpm tpm2"
KERNEL_FEATURES += "features/tpm/tpm.scc"

Description: Demonstrates wolfTPM integration with TPM 2.0 hardware/software support. Includes validation checks to ensure TPM features are properly enabled.

Testing:

  1. Use the included test-wolftpm.sh script in the image directory to run the image with a software TPM simulator (swtpm) in QEMU
  2. Once booted into the QEMU image, run the test binary: 
    /usr/bin/wolftpm-wrap-test

4. wolfssl-py-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfssl-py-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfssl-py - Python bindings for wolfSSL/TLS
  • wolfcrypt-py - Python bindings for wolfCrypt
  • wolf-py-tests - Test suite for Python bindings
  • Python 3 with cffi and pytest

Description: Demonstrates Python integration with wolfSSL. A simple image focused on Python bindings without additional networking features.

Note: For all wolfssl-py tests to pass, you will need to configure networking in the QEMU environment (DNS resolvers, network connectivity, etc.).

5. wolfprovider-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfprovider-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfProvider - OpenSSL 3.x provider using wolfSSL
  • wolfprovidertest - Test application for wolfProvider
  • OpenSSL 3.x library and binaries
  • bash shell

Description: Demonstrates wolfProvider as an OpenSSL 3.x provider, allowing OpenSSL 3.x applications to use wolfSSL's crypto implementation. The image includes OpenSSL configured for wolfProvider compatibility.

6. wolfssl-combined-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfssl-combined-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfssh - SSH library implementation
  • wolfmqtt - MQTT client library
  • wolfProvider with OpenSSL 3.x
  • wolfprovidertest
  • wolftpm with wrap-test and TPM 2.0 tools
  • bash shell

Requirements: Add to your conf/local.conf:

DISTRO_FEATURES += "security tpm tpm2"
MACHINE_FEATURES += "tpm tpm2"
KERNEL_FEATURES += "features/tpm/tpm.scc"

Description: A comprehensive image combining multiple wolfSSL sub-packages (SSH, MQTT, Provider, TPM) for testing interoperability and integration scenarios.

7. wolfclu-combined-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfclu-combined-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • wolfCLU - Command-line utility
  • wolfssl-py - Python bindings for wolfSSL/TLS
  • wolfcrypt-py - Python bindings for wolfCrypt
  • wolf-py-tests - Python test suite
  • Python 3 with cffi and pytest
  • Networking support with DNS configuration
  • ca-certificates

Description: Combines wolfCLU command-line tools with Python bindings, providing both CLI and Python interfaces to wolfSSL. Includes automatic DNS configuration for network-based Python tests.

8. libgcrypt-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal libgcrypt-image-minimal"
require /path/to/meta-wolfssl/conf/wolfssl-fips.conf

Provides:

  • Everything from wolfssl-image-minimal
  • wolfSSL FIPS (configured for libgcrypt support)
  • libgcrypt 1.11.0 with wolfSSL backend
  • libgcrypt-ptest - Test suite
  • ptest-runner - Test execution tool

Special Requirements:

  • Requires wolfSSL FIPS commercial bundle
  • Must set require conf/wolfssl-fips.conf in local.conf

Description: Demonstrates libgcrypt configured to use wolfSSL FIPS as the cryptographic backend. This enables FIPS 140-3 validated cryptography for all applications using libgcrypt (GnuPG, systemd, NetworkManager, cryptsetup, etc.).

Testing:

# In QEMU
ptest-runner libgcrypt

More Information:

9. gnutls-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal gnutls-image-minimal"
require /path/to/meta-wolfssl/conf/wolfssl-fips.conf

Provides:

  • Everything from wolfssl-image-minimal
  • wolfSSL FIPS (configured for gnutls support)
  • gnutls with wolfSSL FIPS backend
  • gnutls-dev, gnutls-bin, gnutls-fips
  • wolfssl-gnutls-wrapper
  • nettle, pkgconfig

Special Requirements:

  • Requires wolfSSL FIPS commercial bundle
  • Must set require conf/wolfssl-fips.conf in local.conf

Description: Demonstrates gnutls configured to use wolfSSL FIPS as the cryptographic backend. This enables FIPS 140-3 validated cryptography for all applications using gnutls.

More Information:

10. gnutls-nonfips-image-minimal

Enable with:

WOLFSSL_DEMOS = "wolfssl-image-minimal gnutls-nonfips-image-minimal"

Provides:

  • Everything from wolfssl-image-minimal
  • gnutls with standard wolfSSL backend (non-FIPS)
  • gnutls-dev, gnutls-bin
  • wolfssl-gnutls-wrapper
  • nettle, pkgconfig

Description: Demonstrates gnutls configured to use standard wolfSSL (non-FIPS) as the cryptographic backend. Use this for testing gnutls+wolfSSL integration without FIPS requirements.

Image Structure

All demo images follow this structure:

recipes-core/images/<image-name>/
├── <image-name>.bb              # Main image recipe
├── wolfssl_%.bbappend           # Configure wolfSSL for this image
├── <package>_%.bbappend         # Disable feature checks for included packages
└── (optional) test scripts      # Helper scripts for testing

Configuration Method

These images use Manual Configuration (Method 3 from the main README):

  1. Image recipes explicitly list packages in IMAGE_INSTALL:append
  2. wolfssl_%.bbappend includes the necessary inc/<package>/wolfssl-enable-<package>.inc files to configure wolfSSL with required features
  3. Package bbappends include inc/wolfssl-manual-config.inc to disable the automatic feature check

This approach ensures wolfSSL is built with the correct configuration for each image's packages without requiring global WOLFSSL_FEATURES or IMAGE_INSTALL settings.

Building Multiple Images

You can enable multiple demo images by space-separating them. Remember to always include wolfssl-image-minimal first:

WOLFSSL_DEMOS = "wolfssl-image-minimal wolfclu-image-minimal wolfssl-py-image-minimal"

Then build each image individually:

bitbake wolfssl-image-minimal
bitbake wolfclu-image-minimal
bitbake wolfssl-py-image-minimal

Note: The base wolfssl-image-minimal must be included in WOLFSSL_DEMOS for any other demo image to be parsable by BitBake.

Running Images

After building, run images with QEMU using:

runqemu <image-name>

For images with special requirements (like wolftpm-image-minimal), use the provided test scripts in the image directory.

Notes

  • All images inherit from core-image-minimal for a minimal footprint
  • wolfSSL is always built with reproducible build flags
  • Images with networking include DNS configuration for internet connectivity in QEMU
  • TPM images require additional DISTRO/MACHINE feature configuration
  • All images include the base crypto tests (wolfcrypttest, wolfcryptbenchmark)